The AWS Philosophy of Security - SID322 - re:Invent 2017

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
N o v e m b e r 3 0 , 2 0 1 7
The AWS Philosophy of Security
SID322
Eric Brandwine, AWS VP and Distinguished Engineer

Some Context

How Do You Do Security?
'Cause I want to security, too!

Is This System Secure?
?

Security Is Easy…

Usable Security Though…

It is the goal of every security
organization to build a system that,
over time, maximizes the delivered
customer value while minimizing
the cost of that delivery.

Rejected Takeoff
6

A List
No pre-flight checklist
No abort when they spot the lock warning light
No abort when they can't throttle up
Use of the auto throttle to attempt to throttle up
FPSOV pulled despite not being on any procedure

The boss will be angry because we have
to abort takeoff. That means we will be
late, and might even miss our clearance
window and be even later.
Maybe we will all die.
or

A review of data from the airplane’s quick
access recorder revealed that the pilots
had neglected to perform complete flight
control checks before 98% of their
previous 175 takeoffs in the airplane,
indicating that this oversight was habitual
and not an anomaly.

“The gradual process through which
unacceptable practice or standards
become acceptable. As the deviant
behavior is repeated without
catastrophic results, it becomes the
social norm for the organization.”

http://science.ksc.nasa.gov/shuttle/missions/
51-l/docs/rogers-commission/Appendix-F.txt

That's how we've always done it.
Nothing bad has ever happened.
I don't think that's how
{humanity/society/the internet} works.

Democracy is the worst
form of government,
except for all the others.
—Winston Churchill

Humans are the worst
way to put together a
security team, except for
all the others.
—not Winston Churchill

What's a Security Guy to Do?
• Calibrate objectively
• Invite (appropriate) outside scrutiny
• Account for the humans in your system
• Service teams
• The Security team
• Customers
• Adversaries
• You

Some
Lots
Many

"Security and operational
excellence are job zero."

Escalate!

Ownership
Leaders are owners. They think long term and don’t
sacrifice long-term value for short-term results. They act
on behalf of the entire company, beyond just their own
team. They never say, “that’s not my job."

Earn Trust
Leaders listen attentively, speak candidly, and treat
others respectfully. They are vocally self-critical, even
when doing so is awkward or embarrassing. Leaders do
not believe their or their team’s body odor smells of
perfume. They benchmark themselves and their teams
against the best.

Customer Obsession
Leaders start with the customer and work backwards.
They work vigorously to earn and keep customer trust.
Although leaders pay attention to competitors, they
obsess over customers.

Measure Everything
and
Report On It

The primary virtue of the programmer is laziness.
—not quite Larry Wall
“Good intentions never work, you need good
mechanisms to make anything happen.”
—Jeff Bezos

0
10
20
30
40
50
60
0-30 30-60 60-90 90+
NumberofReviews
Days Stale
AppSec Review Staleness

Insist On the Highest Standards
Leaders have relentlessly high standards—many people
may think these standards are unreasonably high.
Leaders are continually raising the bar and driving their
teams to deliver high quality products, services, and
processes. Leaders ensure that defects do not get sent
down the line and that problems are fixed so they stay
fixed.

Measure Everything
and
Report On It
and
Take an SLA

Security
Time
Lots

Least Privilege
=
Maximum Effort

Prevention
Analysis Response
Detection

… even well-meaning gatekeepers slow
innovation. When a platform is self-service, even
the improbable ideas can get tried, because
there’s no expert gatekeeper ready to say “that
will never work!” And guess what—many of
those improbable ideas do work, and society is
the beneficiary of that diversity.

What Should I Automate?
?

Is Your System Real-Time?
Maybe?

Action Items
Do the thing you signed up to do 12/31/2017

Action Items

Action Items
1/3/2018

Action Items
12/5/2017
11/5/2017
10/5/2017
9/5/2017

Action Items
7/5/2017

The Short Version
• Humans are weird
• Account for them, you can't patch them
• Security is everyone's job
• Saying it doesn't make it true
• Measure objectively
• Security is all about efficiency
• Guard your resources, especially your humans

Thank you!

The AWS Philosophy of Security - SID322 - re:Invent 2017

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a The AWS Philosophy of Security - SID322 - re:Invent 2017

Semelhante a The AWS Philosophy of Security - SID322 - re:Invent 2017 (20)

Mais de Amazon Web Services

Mais de Amazon Web Services (20)

The AWS Philosophy of Security - SID322 - re:Invent 2017